From b33eeb71b864e97795336293dec42f6eb88acf71 Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Wed, 29 Jul 2026 12:38:27 +0200
Subject: [PATCH] docs(thin-client): fix adcli commands in provisioning guide
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous README used 'adcli precreate' (doesn't exist — the real
command is 'preset-computer') and several non-existent options
(--computer-name on preset, --login-type, administrator@AZ-GROUP as
positional). Caught by user running the commands against real adcli.

Corrected workflow:
- preset-computer takes host FQDN as positional, options are --domain,
  --domain-ou, --os-name, --os-version, --login-user
- join uses --host-fqdn to redirect from local machine to target
  computer object, -K writes only to specified path (does NOT modify
  local /etc/krb5.keytab)
- Added klist verification step for the resulting keytab
- Added prereq note that the OU must exist in AD
- Added TGT-based auth alternative
---
 roles/thin-client/README.md | 42 ++++++++++++++++++++++++++++---------
 1 file changed, 32 insertions(+), 10 deletions(-)

diff --git a/roles/thin-client/README.md b/roles/thin-client/README.md
index b63c9fc..f89d792 100644
--- a/roles/thin-client/README.md
+++ b/roles/thin-client/README.md
@@ -44,32 +44,54 @@ flake entry, and committed.
 
 ### Step 1 — Pre-create the AD computer account + keytab
 
-Run from a host that can reach the AD DC (e.g. `AZ-LT-NIX`):
+Run from a host that can reach the AD DC (e.g. `AZ-LT-NIX`). Requires
+`adcli` (available on the admin workstation via `nix-shell -p adcli` if
+not installed).
+
+Prerequisite: the target OU must exist in AD. If `OU=ThinClients,...`
+doesn't exist yet, create it first (or omit `--domain-ou` to use the
+default `CN=Computers,...` container).
 
 ```bash
 # Pre-create the computer object in the ThinClients OU
-adcli precreate --computer-name=AZ-TC-01\$ \
+adcli preset-computer \
   --domain=az-group.local \
-  --host-fqdn=AZ-TC-01.az-group.local \
-  --login-type=computer \
-  --os-name="NixOS" --os-version="25.11" \
   --domain-ou="OU=ThinClients,DC=az-group,DC=local" \
-  administrator@AZ-GROUP
+  --os-name="NixOS" --os-version="26.05" \
+  --login-user=administrator \
+  AZ-TC-01.az-group.local
 
-# Join offline and produce a keytab (no real join happens)
-adcli join --computer-name=AZ-TC-01\$ \
+# Produce a keytab for that pre-created computer object.
+# --host-fqdn redirects adcli from the local machine to the AZ-TC-01
+# account; -K writes only to the specified path (does NOT modify the
+# local machine's /etc/krb5.keytab).
+adcli join \
   --domain=az-group.local \
   --host-fqdn=AZ-TC-01.az-group.local \
-  --login-type=computer \
-  --user=administrator --verbose \
+  --os-name="NixOS" --os-version="26.05" \
+  --login-user=administrator \
   -K /tmp/AZ-TC-01.keytab
 
+# Verify the keytab has expected principals
+klist -k /tmp/AZ-TC-01.keytab
+# Expected principals:
+#   AZ-TC-01$@AZ-GROUP
+#   host/AZ-TC-01.az-group.local@AZ-GROUP
+#   RestrictedKrbHost/AZ-TC-01.az-group.local@AZ-GROUP
+#   HOST/AZ-TC-01@AZ-GROUP
+#   RestrictedKrbHost/AZ-TC-01@AZ-GROUP
+
 # Provision the agenix secret
 agenix -e secrets/AZ-TC-01-krb5-keytab.age
 # In the editor: paste /tmp/AZ-TC-01.keytab contents, save, exit.
 rm /tmp/AZ-TC-01.keytab
 ```
 
+Tip: if you already have an admin TGT (via `kinit administrator@AZ-GROUP`),
+you can replace `--login-user=administrator` with
+`--login-ccache=${KRB5CCNAME:-/tmp/krb5cc_$(id -u)}` to skip the password
+prompt.
+
 ### Step 2 — Provision NetBird setup key
 
 In the NetBird UI (`https://netbird.az-group.local`):